AI Act · Explainer

Who supervises the AI Act in Luxembourg: CNPD, CSSF, CAA and draft law No. 8476

Draft law No. 8476 makes the CNPD Luxembourg's default AI Act authority, with the CSSF and CAA for their sectors. It was still not adopted in October 2026.

6 October 20265 min readlbfrdeen

Finance & DORA · News

CSSF issues extra DORA incident-reporting instructions: what Luxembourg financial entities must fill in

On 29 September 2026 the CSSF added seven field-level instructions to the ESAs' guidance on DORA major ICT incident reports, aimed at better data quality.

6 Oct 20263 min readlbfrdeen

AI Act · Analysis

AI Act high-risk rules in autumn 2026: what the Digital Omnibus delay means for Luxembourg

The Digital Omnibus moved AI Act high-risk duties from 2 August 2026 to 2 December 2027 and 2 August 2028. Other obligations already apply in Luxembourg.

1 Oct 20264 min readlbfrdeen

Public sector · Analysis

NIS2 in Luxembourg: the law of 5 May 2026, who is in scope and what the ILR and CSSF expect

Luxembourg transposed NIS2 by the law of 5 May 2026, in force since 10 May 2026: scope, ILR and CSSF supervision, registration, incident reporting and DORA.

30 Sept 20264 min readlbfrdeen

Explainers

All explainers →

DORA register of information in Luxembourg: reporting to the CSSF and CAA, and the data behind it6 min MeluXina-AI and the Luxembourg AI Factory: status in 2026 and how to get access6 min Data owner vs data steward vs data custodian: who is accountable for what6 min LNDS explained: Luxembourg's National Data Service, public data reuse and the health data space6 min AI literacy under AI Act Article 4: what Luxembourg organisations must do5 min EU Data Act in Luxembourg: obligations, key dates and the ILR's planned role5 min

Topics

AI ActHow the EU AI Act is applied and supervised in Luxembourg, and what organisations must do.Data governanceOwnership, data quality and master data: the practical side of managing data well.Finance & DORADORA, BCBS 239 and CSSF requirements, seen through the lens of data.Public sectorMeluXina, the AI Factory, LNDS, NIS2 and national strategy.ExplainersShort, evergreen answers to the questions people actually ask.

Regulatory clock

2026-08AI Act · transparency duties (Art. 50)
2026-09Data Act · data-access by design for new products
2026-12AI Act · new prohibitions; AI-content marking for existing systems
2027-01Data Act · cloud switching charges end
2027-08AI Act · national AI sandboxes due
2027-09Data Act · unfair-terms rules reach older contracts

Questions & answers

Who is the AI Act authority in Luxembourg?

Draft law No. 8476 designates the CNPD as the default market surveillance authority and single point of contact. As of 6 October 2026 the bill had not been adopted, so the designation was not yet law. More →

Does the CSSF supervise AI used by banks and investment firms?

The bill makes the CSSF the market surveillance authority for AI systems placed on the market, put into service or used by entities it supervises. The Conseil d'État asked for this to be limited to AI directly connected with the provision of financial services, as Article 74(6) of the AI Act requires. More →

Does Luxembourg have an AI regulatory sandbox?

The CNPD has run a GDPR-based sandbox, Sandkëscht, since May 2024 and announced that AI Act sandbox submissions would open in August 2026. The bill gives the CNPD the task of setting up the national AI Act sandbox; the EU deadline is now 2 August 2027. More →

Can companies ignore the AI Act until the Luxembourg law is voted?

No. The AI Act is an EU regulation that applies directly. Prohibited practices, AI literacy, general-purpose AI rules and Article 50 transparency obligations already apply, whatever the status of the national law. More →

Follow Dataplaz

Subscribe via RSS to get every new article.

RSS · /en/rss.xml